Newsgroups: alt.security,comp.security.misc,comp.security.unix,comp.unix.admin,comp.answers,news.answers,alt.answers
From: cklaus@anshar.shadow.net (Christopher Klaus)
Subject: computer-security/security-patches FAQ
Message-ID: <393b8a$4pr@anshar.shadow.net>
Organization: ISS, Inc.
Date: Mon, 31 Oct 1994 17:58:34 GMT

Archive-name: computer-security/security-patches 
Posting-frequency: monthly
Last-modified: 1994/9/15
Version: 1.3

	Security Patches FAQ for your System: The Patch List


	As new systems become accessible by networks there is a need for
security.  Many systems are shipped insecure which puts the responsibility on
the customers to find and apply patches.  This FAQ will be a guide for the many
administrators who want to secure their systems.

	This FAQ will be broken down into the different sections:

Part 1 - Generic Things to Look For
Part 2 - Type of Operating System and its Vulnerabilities.
Part 3 - Particular Vulnerabilities (ie. rdist and sendmail)
Part 4 - Unpatched Vulnerabilities



Part 1 - Generic Things to Look For

One of the best methods of stopping pontential intruders is to use
a firewall to block all udp traffic except for dns and nameserver ports.

Blocking all source routing and rlogin, rsh at the router.

Use one-time password technology like s/key.  
Shadow passwords if you do not use one-time pw technology.
Replace passwd with a program that will not allow your users to
pick easy passwords.

Check all passwords for easy-to-guess with Crack.

Check to make sure you have the newest sendmail installed.

Do a rpcinfo -p command and check to make sure rexd is not running.

Check to make sure tftp is turned off.

Make sure there is no '+' in /etc/hosts.equiv or any .rhosts.
Make sure there are no '#' in /etc/hosts.equiv or any .rhosts.
Make sure there are no funny commands in any .forward.
Make sure there are no cleartext passwords in any .netrc.

Do a showmount -e command to see your exports and make sure they are restricted
to only trusted hosts.  Make sure all exports have an access list.

Use Xauthority when using X11 or openwin.

chmod 000 rdist, chill, pstat, arp

Run tripwire regularly.	ftp.cs.purdue.edu:/pub/spaf/COAST/Tripwire
Run COPS regulary.	ftp.cert.org:/pub/tools/cops
Run Tiger regularly.	net.tamu.edu:/pub/security/TAMU
Run ISS regulary.	aql.gatech.edu:/pub/security/iss
Run a TCP Wrapper	ftp.win.tue.nl:/pub/security/tcp_wrappers_6.3.shar.Z

Identd may help locate accounts that intruders are using on remote and local
machines.  It is on  ftp.lysator.liu.se:/pub/ident/servers


Part 2 - Type of Operating System and its Vulnerabilities

To find some of the newer patches, using archie and xarchie can be a useful
tool.  Some caution must be used when using patches obtained from FTP sites.
It is known that some ftp sites have been compromised in the past and files
were replaced with trojans.  Please verify the checksums for the patches. 


AIX

rlogin patch - anonymous FTP software.watson.ibm.com (129.34.139.5) /pub/rlogin.

Patch: ix22628   Fix: Corrects TFTP from allowing people to grab /etc/passwd.

Fixdist package available at ftp:s6k.boulder.ibm.com
Fixdist is a X Windows front end to the AIX PTF (Patch) Database.

Fixdist requirements:

  Software:                                                                    
    AIX for RISC System/6000 Version 3.2.4 or above.                           
    AIX TCPIP Facilities (bosnet.tcpip.obj)                                    
    AIXwindows 1.2.0 (X11R4) or AIXwindows 1.2.3 (X11R5).                      
                                                                               
  Connection Requirements                                                      
                                                                               
    The fixdist utility communicates to the ftp server using                   
    anonymous ftp.  There is no mail transport or Telnet requirement.          
    The server is currently available only on the Internet.  If you            
    are able to download the utility, you are fully enabled use fixdist.            

Fixdist does not "install" any PTFs onto your system.  It just transfers 
the fixes to a target directory on your RISC System/6000.     




DEC


Security kits are available from Digital Equipment Corporation by contacting
your normal Digital support channel or by request via DSNlink for electronic
transfer.

Digital Equipment Corporation strongly urges Customers to upgrade to a
minimum of ULTRIX V4.4 and DEC OSF/1 V2.0 then apply the Security Enhanced
Kit.
        - Please refer to the applicable Release Note information prior to
          upgrading your installation.

KIT PART NUMBERS and DESCRIPTIONS

CSC PATCH #

CSCPAT_4060  V1.0   ULTRIX    V4.3 thru V4.4  (Includes DECnet-ULTRIX V4.2)
CSCPAT_4061  V1.0   DEC OSF/1 V1.2 thru V2.0

         These kits will not install on versions previous to ULTRIX V4.3
         or DEC OSF/1 V1.2.

The ULTRIX Security Enhanced kit replaces the following images:                                                                                                     
/usr/etc/comsat                 ULTRIX V4.3, V4.3a, V4.4               
/usr/ucb/lpr                    "                      "
/usr/bin/mail                   "                      "
/usr/lib/sendmail               "                      "
                    *sendmail - is a previously distributed solution.            

/usr/etc/telnetd                ULTRIX V4.3, V4.3a only

For DECnet-ULTRIX V4.2  installations:

/usr/etc/dlogind
/usr/etc/telnetd.gw

The DEC OSF/1 Security Enhanced kit replaces the following images:

/usr/sbin/comsat                DEC OSF/1 V1.2, V1.3 V2.0
/usr/bin/binmail
/usr/bin/lpr                    "                       "

/usr/sbin/sendmail              DEC OSF/1 V1.2, V1.3  only
                    *sendmail - is a previously distributed solution.
/usr/bin/rdist                  "                       "
/usr/shlib/libsecurity.so       DEC OSF/1 V2.0 only




HPUX

In order to retrieve any document that is described in this index, send the
following in the TEXT PORTION OF THE MESSAGE to support@support.mayfield.hp.com:

send doc xxxxxxxxxxxx

Summary of 'Security Bulletins Index' documents

Document Id    Description	
HPSBUX9407-015 Xauthority problem
HPSBUX9406-014 Patch file permissions vulnerability
HPSBUX9406-013 vhe_u_mnt allows unauthorized root access
HPSBUX9405-011 Security Vulnerability in HP GlancePlus
HPSBUX9405-009 PROBLEM:  Incomplete implementation of OSF/AES standard
HPSBUX9405-010 ftpd: SITE CHMOD / race condition vulnerability
HPSBUX9405-012 Security vulnerability in Multimedia Sharedprint
HPSBUX9404-007 HP-UX does not have ftpd SITE EXEC vulnerability
HPSBUX9404-008 Security Vulnerability in Vue 3.0
HPSBUX9402-006 Security Vulnerability in DCE/9000
HPSBUX9402-005 Security Vulnerability in Hpterm
HPSBUX9402-004 Promiscuous mode network interfaces
HPSBUX9402-003 Security Vulnerability in Subnetconfig
HPSBUX9312-002 Security Vulnerability in Xterm
HPSBUX9311-001 Security Vulnerability in Sendmail

If you would like to obtain a list of additional files available via the HP
SupportLine mail service, send the following in the TEXT PORTION OF THE MESSAGE
to support@support.mayfield.hp.com:

send file_list

or to get the newest security patch list:

send security_info_list

HP-patches and patch-information are available by WWW:
1) with URL 
     http://support.mayfield.hp.com/slx/html/ptc_hpux.html 
     http://support.mayfield.hp.com/slx/html/ptc_get.html
2) or by appending the following lines to your 
   $HOME/.mosaic-hotlist-default and 
   using the --> navigate --> hotlist option.

HP has a list of checksums for their security patches.  Highly recommended
you always compare patches with the checksum for corruption and trojans.



NEXT


ftp.next.com /pub/NeXTanswers/Files/Patches 
   SendmailPatch.23950.1
   RestorePatch.29807.16

ftp.next.com /pub/NeXTanswers/Files/Security contains some advisories.

Be sure to check your Next for Rexd and uuencode alias.





SCO Unix

Current releases of SCO UNIX (3.2v4.2) and Open Desktop (3.0) has the
following security patches available:

  uod368b -- passwd
  oda377a -- xterm, scoterm, scosession, clean_screen
  net379a -- sendmail

These can be downloaded from ftp.sco.com under the directory /SLS.
First get the file "info" which lists the actual filenames and
descriptions of the supplements.




Sun Microsystems, Inc.  SunOS 4.x 

	Patches may be obtained via anonymous ftp from ftp.uu.net (in the
sun/sun-dist directory) or from local Sun Answer Centers worldwide. Sun makes
lists of recommended patches (including security patches) available to customers
with support contracts via its Answer Centers and the SunSolve service. The
lists are uploaded on an informal basis to the ftp.uu.net patch repository
maintained by Sun for other customers, and posted periodically on the
comp.security.unix newsgroup.

Patches are also available via anonymous ftp from 
  sunsolve1.sun.com:/pub/patches 
  online.sunsolve.sun.co.uk:/patches/SECURITY/ALL

Check out the the sunsolve www-page at http://online.sunsolve.sun.co.uk/

Below is a list of security patches that should be implemented.  Please use
Sun's patch list for the authoritative answer.  If you see any discrepencies
please notify the author of this FAQ.  

100075-11	rpc.lockd jumbo patch
100103-11	script to change file permissions to a more secure mode
100170-10	jumbo-patch ld-1.144 shared LD_LIBRARY_PATH -Bstatic SPARCworks
100173-09	NFS Jumbo Patch
100178-08	netd "broken server detection" breaks on fast machines
100249-09	automounter jumbo patch
100272-07	security hole in utmp writable
100283-03	in.routed mishandles gateways, multiple routes
100296-04       rpc.mountd exports to the world
100305-14       lpr package
100338-05	system crashes with assertion failed panic.(may be obsolete)
100342-03	NIS client needs long recovery time if server reboots
100359-06	streams jumbo patch
100377-07       sendmail + sendmail.mx 
100383-06       rdist can be used to get root access
100421-03       rpc.rexd does not log appropriate accounting messages
100448-01       loadmodule 
100482-04       ypxfrd exporting NIS maps to everybody
100507-04	tmpfs jumbo patch
100527-03	rsh uses old-style selects instead of 4.0 selects
100536-02	NFS can cause panic: assertion failed crashes
100557-02	ftp Jumbo patch
100564-07	C2 Jumbo patch
100567-04	mfree panic due to mbuf being freed twice
100593-03	security hole in utmp writable
100623-03	UFS jumbo patch
100909-02	security hole in utmp writable
101480-01	security hole in utmp writable
101481-01	security hole in utmp writable
101482-01	security hole in utmp writable

Sendmail patches as follows:

         OS version      Patch ID    Patch File Name
         ----------      ---------   --------------- 
         4.1.1           100377-15   100377-15.tar.Z
         4.1.2           100377-15   100377-15.tar.Z
         4.1.3           100377-15   100377-15.tar.Z
         4.1.3_U1        101665-02   101665-02.tar.Z
         5.1_x86         101352-03   101352-03.tar.Z
	 5.1             100834-11   100834-11.tar.Z
	 5.2             101842-01   101842-01.tar.Z
         5.3             101739-01   101739-01.tar.Z                                                                                                                

Turn off IP-Forward on SunOs Kernel and kmem via:

"echo ip_forwarding/W 0" | adb -w /vmunix /dev/kmem



To turn off source routed packets on Solaris 2.X.

Edit /etc/rc.2.d/S69.inet and change

ndd -set /dev/ip ip_forwarding 0
ndd -set /dev/ip ip_ip_forward_src_routed 0

reboot.

Source routing patch for SunOs 4.1.x
ftp.greatcircle.com:/pub/firewalls/digest/v03.n153.Z


To Secure a Sun console physically:

(for desktop sparc models)
$su
#eeprom security-mode=command
Password:
Retype password:
#

(for other models)
$su
#eeprom secure=command
Password:
Retype password:
#

This restricts access to the new command mode.

Remove suid from crash, devinfo

The following is a package of patches for SunOs from Australian group SERT:
ftp.sert.edu.au:/security/sert/tools/MegaPatch.1.7.tar.Z





SGI

ftp.sgi.com:/pub/sgi/IRIX
ftp.sgi.com and sgigate.sgi.com have a "/security" directory.

{3.3,4.0,5.0} including sendmail and lpr.  lpr allowed anyone to get root
access.

Patch65 and patch34 correct vulnerability in SGI help system which enabled
users to gain root priviledges.

                Standard      System V       MD5
                Unix          Unix           Digital Signature
patch34.tar.Z:  11066 15627   1674 31253     2859d0debff715c5beaccd02b6bebded
patch65.tar:    63059 1220    15843 2440     af8c120f86daab9df74998b31927e397

Check for the Following:

Default accounts with no passwords: 4DGifts, lp, nuucp, demos, tutor, guest,
 tour

To Disable IP_Forwarding on SGI:
edit /usr/sysgen/master.d 
change int ipforwarding = 1 to 0;
then recompile kernel by autoconfig -f; for IRIX 4.0.5
/*
 * This parameter affects hosts with more than 1 hardware network interface.
 * Hosts that have only a single interface will not forward IP packets.
 *
 * 1 = Forward IP packets received that should be resent to another host.
 * 0 = Don't forward packets. ipgateway affects if an ICMP error is sent or not. * * This parameter also enables/disables IP source routing.
 *
 * IP multicast packets can be forwared if the boot/ip_mroute.o file exists
 * when the kernel is configured and the mrouted(1M) daemon is used.
 */
int ipforwarding = 1;

Remove suid from /usr/sbin/colorview
Remove suid from /usr/lib/vadmin/serial_ports on Irix 4.X
Remove suid from /usr/bin/under

/usr/etc/arp is setgid sys in IRIX up to and including 5.2, allowing anyone
who can log into your machine to read files which should be readable only
by group 'sys'.

Remove suid from /usr/sbin/cdinstmgr
Remove suid from /etc/init.d/audio
chmod g-w /usr/bin/newgrp

/usr/sbin/printers has a bug in IRIX 5.2 (and possibly earlier 5.x versions)
which allows any user to become root.

/usr/sbin/sgihelp has a bug in IRIX 5.2 (and possibly earlier 5.x versions)
which allows any user to become root. This is so bad that the patch is
FTPable from ftp.sgi.com:/security/, and SGI is preparing a CD containing
only that patch.

The version of inst which comes with patch 34, which is required for
installation of all other patches (even those with lower numbers) saves old
versions of binaries in /var/inst/patchbase. It does not remove execution or
setuid permissions.

---

Part 3 - Particular Vulnerabilities


Ftp 

Check the Secure Anonymous FTP FAQ for the latest ftp daemons that you need
to install. 


Sendmail Patches

    SCO UNIX (3.2v4.2) net379a -- sendmail

    Sun OS version  Patch ID    Patch File Name
    --------------  ---------   --------------- 
    4.1.1           100377-15   100377-15.tar.Z
    4.1.2           100377-15   100377-15.tar.Z
    4.1.3           100377-15   100377-15.tar.Z
    4.1.3_U1        101665-02   101665-02.tar.Z
    5.1_x86         101352-03   101352-03.tar.Z
    5.1             100834-11   100834-11.tar.Z
    5.2             101842-01   101842-01.tar.Z
    5.3             101739-01   101739-01.tar.Z                                                                                                                

    File            BSD          SVR4        MD5
    Name            Checksum     Checksum    Digital Signature
    --------------- -----------  ----------  --------------------------------
    100377-15.tar.Z 03367   756  44976 1511  F030E8D13EF70F540FE88DE5855BC101
    101665-02.tar.Z 10559   230  65031  459  0F34BB17977EB95901FFD19A45091E14
    101352-03.tar.Z 57618   561  39900 1121  4F91E0E24066DC6F7FA5C742A9A282D2
    100834-11.tar.Z 02013  1701  21089 3402  CF94A5B0E149BAA1056EDC8035FD550A
    101842-01.tar.Z 47566   192  30222 384   3EE2EF8F9FEC43A3EFB5251AB4C033FA
    101739-01.tar.Z 40730   204  12341 407   D521709A8C6B46BADA393EC2B505C5A8



Rdist Patches

(Unless you really need rdist, chmod 000 rdist works fine.)

Apollo Domain/OS SR10.3 and SR10.3.5 (Fixed in SR10.4)

a88k PD92_P0316
m68k PD92_M0384

Cray Research, Inc. UNICOS 6.0/6.E/6.1  Field Alert #132   SPR 47600

IBM  RS/6000 AIX levels 3005, 2006, 2007, and 3.2  apar ix23738
Patches may be obtained by calling Customer Support at 1-800-237-5511.

MIPS  RISCos versions 4.50 through 4.52 (not required for 5.0)
      Patches are available via anonymous ftp at ftp.mips.com.
      The file is /pub/rdist.CERT.tar.

NeXT Computer, Inc.  NeXTstep Release 2.x
     Rdist available on the public NeXT FTP archives.

Silicon Graphics   IRIX 3.3.x/4.0 (fixed in 4.0.1)
        Patches may be obtained via anonymous ftp from sgi.com in the
        sgi/rdist directory.

Solbourne	OS/MP 4.1A	Patch ID P911121003

Sun Microsystems, Inc.  SunOS 4.0.3/4.1/4.1.1  Patch ID 100383-06




Part 4 - Unpatched Vulnerabilities

This is intended to let consumers know that these holes have already been
fully disclosed and everyone already knows about it.  These are the 
vulnerabilities that vendors are suppose to be releasing patches for
ASAP.  Hopefully this list will stay short and small. 


Vendor          Bug                 Result
Sun             passwd -F hole.     Gives root access to anyone.
Most Unixes     /bin/mail           Gives root access to anyone.
Sun5.x          no promisc flags    Can not tell if machine is sniffing

---


Acknowledgements


	I would like to thank the following people for the contribution
to this FAQ that has helped to update and shape it:

Jonathan Zanderson (jsz@ramon.bgu.ac.il)
Rob Quinn <rjq@phys.ksu.edu>
Dr.-Ing. Rudolf Theisen, <r.theisen@kfa-juelich.de>
Gerald (Jerry) R. Leslie <jleslie@dmccorp.com>


Copyright

This paper is Copyright (c) 1994 
 by Christopher Klaus of Internet Security Systems, Inc. 


	Permission is hereby granted to give away free copies.  You may 
distribute, transfer, or spread this paper.  You may not pretend that you
wrote it.  This copyright notice must be maintained in any copy made.  


Disclaimer

	The information within this paper may change without notice. Use of
this information constitutes acceptance for use in an AS IS condition.
There are NO warranties with regard to this information. In no event shall
the author be liable for any damages whatsoever arising out of or in
connection with the use or spread of this information.  Any use of this
information is at the user's own risk.  This FAQ and its list of patches
are not gauranteed to be up to date nor do the vendors support or endorse
this FAQ.  



Address of Author


	Please send suggestions, updates, and comments to:	
 
	Christopher Klaus <cklaus@shadow.net> 
	of Internet Security Systems, Inc. <iss@shadow.net>


-- 
Christopher William Klaus  <cklaus@shadow.net>  <iss@shadow.net>
Internet Security Systems, Inc.         Computer Security Consulting
2209 Summit Place Drive,              Penetration Analysis of Networks
Atlanta,GA 30350-2430. (404)518-0099. Fax: (404)518-0030

